In this article · 4 sections
India's Digital Personal Data Protection (DPDP) Act, 2023 governs how organisations handle digital personal data. Its Rules were notified in 2025 with phased timelines. If your website collects names, phone numbers or emails through forms, WhatsApp or bookings, DPDP Act website compliance matters to you.
Key roles
- Data principal: the person whose data it is (your customer)
- Data fiduciary: the business deciding why and how data is processed (you)
- Data processor: a service processing data for you (hosting, email, CRM)
Practical checklist
- Map your data: list every form, tool and place where personal data is collected or stored
- Notice: tell people what you collect, why, and how to exercise rights, in clear language. Update your privacy policy
- Consent: for marketing messages, use a clear unticked checkbox; don't bundle consent
- Purpose limitation: use enquiry data to answer the enquiry, not for unrelated purposes without consent
- Minimise: don't ask for data you don't need (e.g. date of birth on a taxi enquiry)
- Security safeguards: HTTPS, strong passwords, 2FA, access limits, backups. See cybersecurity tips
- Processors: use reputable hosts and tools with proper terms
- Rights: a way for people to access, correct or delete data and withdraw consent
- Retention: delete data when no longer needed
- Breach response: a plan to notify the Data Protection Board and affected people. See data breach response
- Grievance contact: published on the website
- Children's data: verifiable parental consent is required for under-18s
Penalties
The Act allows significant financial penalties, with the highest tiers (up to ₹250 crore) for failing to take reasonable security safeguards. Small businesses are rarely the focus, but basic compliance is inexpensive.
FAQs
Does DPDP apply to a small local business website?
If you process digital personal data in India, generally yes; some obligations are lighter for smaller fiduciaries.
Are WhatsApp chats covered?
Customer data you collect and store digitally, including chats and contact lists, is personal data.
This article is general information, not legal advice. Check current rules and timelines.
Was this article helpful?
Your answer helps us improve our guides